All RFC1006 clients have parameters that can be used to specify the subsequent PLC address. There are clients available that are using the Rack / Slot parameters for this adressing scheme and there are clients available that are using the TSAP adressing scheme. With either or you are able to specify the MPI/PROFIBUS address you want to send the command to.
The following table gives you an overview the parameters and their values in order to address PLCs from address 0 to 126:
